I would be surprised to learn of any major military power today that DOESN'T have a cyberwarfare division (and god knows how many government contractors doing it on the sly). This only exposes something publicly that every security researcher has known for over a decade.

But somehow Hillary Clinton failed to stress the danger the US is in every day because of Chinese military-sponsored attacks on US corporations' websites. Hopefully (doubtfully) John Kerry will be more transparent.

Do you expect a politician to admit when they've left their guard down? Take a look at the Embassy killings in Benghazi if you want a road map as to how the State Department handles transparency.

The fact of the matter is that we are under attack daily from interests by foreign governments or by organizations that receive support and funding from those same governments. Espionage has changed, it doesn't take collateral assets to infiltrate factories when you can hire a bunch of college kids to hack the aerospace firms systems or get those strategy documents from the banking firm. What has to happen is that people need to start treating the Internet like their front door. Firewalls as good, but you don't let just any information out of your home and you certainly don't let everybody in your house either. The Chinese have been observed for years for doing this, so here's a simple thought: Disconnect them from the Internet. Oh wait, that would cause problems with international conventions on fairness right? Frankly if the Obama administration took this seriously they'd be sending that message: Either clean up your act or we'll disconnect your access. Sure they can then proxy or go elsewhere but at least it would be a stand instead of the constant words going back and forth. The Chinese will only respond to actions, not words and we have to start taking more actions where this is concerned.

There are plenty of secrets beyond raw technology that are well worth pursuing. If China was secretly positioning assets for a strike on Taiwan for example, that's important strategic information. Even knowing the conditions which would cause such activity is priceless. Then we have influence that can be gained over party officials by access to their files, actual versus reported expenditure patterns, and much more.

1) I am sure US totally wants to steal information on any stealth fighter developing in China. They want to know what they are making. And I am sure there are many efforts in progress to gain as much information as possible.

2) "Free" vs "Un-Free" is not the determining factor is innovation and scientific achievements now or into the future. You should be more worried about spending on education, society's attitude to science and bans on things like stem cell research. In the spending on education and societ

I would be surprised to learn of any major military power today that DOESN'T have a cyberwarfare division (and god knows how many government contractors doing it on the sly). This only exposes something publicly that every security researcher has known for over a decade.

I'm sorry, you were saying you have evidence of the United States targeting civilians, newspapers and non-military corporations by paying a third party to do it and then denied it? This isn't pot/kettle this is apples/oranges.

Do what now? I'm not really sure where you were going with your comment but I personally know of people in 3rd party contractor organizations that participate in cyberwarfare (I obviously don't know what they do or who they target). I don't see where the parent said the US was targeting civilians, newspapers, or non-military corps, just that the organization and 3rd parties exist.

If the intent is to imply that the US gov't has a cyberwarfare division and does use it in the manner you stated while denyi

Westerners seem to have retained since Wallace's time the inability to learn to distinguish between who is a "traitor" and who is an invaded enemy. And today sanctimonious traitors declare which own citizen to invigilate, falsely accuse, torture or kill. Go fuck yourself, USAn moron.

Except that the West goes after military targets. China targets civilians.

You're not paying attention. Don't whitewash "the West" - it's governed by corrupt sociopaths who are morally no different from the rulers of China. Our institutions are designed to be less corruptable (which is why our leaders have been changing them) but the humans in power are at least equally evil.

The series of worms the USA and Mossad introduced in Iran (presumably to keep Shiites from reaching nuclear parity with the West) caused civilian collateral damage to US and Scandinavian businesses. The Bush/Obama administration has laughed it off; the only thing they regret was giving Israel the keys to the worms, which turned out to be a scarily bad idea. They don't seem to regret the car-bombing campaign "the West" directed against civilian Iranian scientists and their families, either. This isn't any "conspiracy theory" crap, either, it's recent history. It's exhaustively documented in wikipedia [wikipedia.org] at this point, as well as newspapers and books.

Here in reality [tm] all the existing countries that have the capacity to harm designated "enemies of the state" and get away with it, regardless of civilian/military status, seem quite willing to do so. That includes the Vatican and probably would include the Dalai Lama if he had the ability. Obama's administration blows up teenagers with US citizenship, and Bush's administration knowingly tortured innocent people [wikipedia.org] to death for amusement. They're all evil.

Yeah, wanting theocracies where the national mythos involves sacrificing yourself to kill your enemy to not have nukes is just foolish. Wanting the entire middle east to not have to go into a nuclear arms race is just 'evil'.

Your idiocy seems to know no bounds. You lack even the most basic ability to think rationally about the world around you.

I had to re-read the gp to assure myself you were actually attempting to respond to it.Congratulations, you made three arguments that had nothing directly to do with the post you were responding to.

GP: "Don't whitewash the west; the individuals in power are no better than those in the mid-east -- we just (currently) have better checks and balances in place"

You: "You're an idiot, we don't want the mid-east getting nukes."

I did read both of those correctly, yes? I think the original point was that we also do

Sure, we all have cyber warfare groups...but I don't think most are actively attacking commercial interests with the goal of stealing IP for domestic companies to use like the Chinese do. I think most countries cyber efforts are more focused on defense related espionage.

Somehow, I fail to see the difference. We want certain kinds of information, that we believe will make our nation stronger. They want any and all information, that they believe will make their nation stronger.

Of course if such entities were any good they might be run by an entity different from that which appears to be running them.

You mean No Such Agency? They keep such a low profile that they might, for all I know, be the only competent government agency we have. I sure hope so. I don't want the Chinese to cut off my electricity—my UPS is only good for an hour.

I think the news isn't that China has an unofficial hacking department, but that someone's managed to narrow down exactly where they work from. This makes it difficult for China to claim that the hackers are private individuals or non-government businesses.

... to the contractors. This just looks like WMD in Iraq again -- you (taxpayers) paid a trillion dollar to find out the whole thing was fake and yet nobody got punished. For this one, you will spend billion$ and still won't know if it is real -- after all we can't invade China to find out. When somebody tries to sell you something hard, it must be fishy.

I just wonder why a sophisticate spy operation forgot to fake their IP addresses but leave all trails to one location, given that they have controls of the

I was so excited when I got my first wireless router a number of years ago that I used to check the in/out listings daily. I did not care too much about unauthorized access (who would want to monitor me?) so I just chose the Netgear defaults. I quickly found out that a number of DAILY accesses were from somewhere in China. They were not from the same places in China, but they were from China nonetheless. I quickly made the security corrections. Fortunately they do not seem to get in now. Emphasis on the words "seem to".

A lot of people forget that the population of China is what, 1/5th the world's population?

As such it would make statistical sense that around 1/5th of attacks they see are from China.

This is a figure that tallies roughly pretty well with attacks I've seen on every net facing system I've bothered to monitor. I wouldn't say there are proportionally more attacks from China relative to their share of the world's population than anywhere else. Given the US' population, Russia's population, or a number of South American and Eastern European states whose names I've seen popup a fair bit it's actually the case that I see disproportionally more attacks from these states relative to their population.

I'm not defending China though, I don't buy the conspiracy theories, I think China genuinely is trying to get ahead in the world by stealing corporate secrets more so than anywhere else. The problem is, that Western states are easy targets because they assume that every country is like their own - that no competitor will hack them because that would be corporate suicide for their competitor if the truth ever came to light - the problem with this is that it ignores nations where the governments actively support such activity, rather than come down on it with the full force of the law more actively.

My point though is this, even in TFA it mentions that only something like 140 organisations have been targeted by this group. That's not really a lot, so if you see hack attacks on your personal router it's simple paranoia to assume the Chinese government is trying to hack you rather than a simple statistical likelihood that China has it's share of blanket IP/port scanning script kiddies as anywhere else too. If however you work for a Fortune 500 with something of value, there's a much greater chance that they are indeed out to get you.

I have to agree for the general case, and that may be what the case was with me. I should add that I had applied for a patent about a year before so it may have made sense for a state sponsored effort to hack my machine. It is hard not to be xenophobic when something like that happens to you.

I think you need to get a better understanding of statistics, particularly the relevance of sample sizes, and the irrelevance of outliers in a discussion like this.

Fundamentally, the proportion of attacks coming from China is a reasonable enough figure to explain away state sponsorship, or targeted attacks as a general rule when seeing attacks originating from China because the figure isn't disproportionately high relative to the population of the country. If you don't understand why that's simple fact then

A lot of people forget that the population of China is what, 1/5th the world's population?

As such it would make statistical sense that around 1/5th of attacks they see are from China.

This is a figure that tallies roughly pretty well with attacks I've seen on every net facing system I've bothered to monitor. I wouldn't say there are proportionally more attacks from China relative to their share of the world's population than anywhere else. Given the US' population, Russia's population, or a number of South American and Eastern European states whose names I've seen popup a fair bit it's actually the case that I see disproportionally more attacks from these states relative to their population.

That correlation doesn't hold, I think. A more appropriate one would be to compare learned users of each country's population that can access the Internet. My understanding is that the majority of China is poverty-stricken and not using the Internet. And by this same position, I would expect the cracking attempts from US-based locations to vastly outnumber all other states in sheer number, but I don't believe that's the case either.

Another poster had the right angle, I think. The number is greatly influ

I did a search and found nothing. Boing is suspecting of helping the CIA (which would be a good), but not vice-versa.

On the other hand, Obama actually admitted the US was involved in the virus that hit the Uranian nuclear materials processing plant. I suspect it was a calculated admission, not and inadvertent one, but an admission nonetheless.

I've noticed this too, and always suspected that the world's routers are somehow working with seemingly innocent sites acting as a kind of mesh botnet for foreign entities (mostly Chinese). Can you tell us what you do to keep them out?

If you examine the Netgear log, you should never get anything of the type below, as it is something that Negear would have allowed in whether you liked it or not. The example below is from Jinan, China.

The Communist Party may be segmented from the state apparatus to some degree, but in the end, the same people are giving the orders to both.

Although, it is important to consider that the PLA is it's own constituency within China and it even runs its own factories. It is entirely possible that the PLA is just muscling the commercial competition, as opposed to say, preparing for the opening moves of WW3. Of course, since it is China's military, it could be equal parts of both.

I think this should be a wakeup call for companies to allocate finance to IT security. It’s hard to go to the board and explain that you need xx£$ for beefing up security if you have not been a target of a hack attempt/virus etc..

Interesting that you say that. The French spy on people and pass stuff back to French businesses. It's also interesting that in France, big business and big government are, unlike the US, very cozy.

In the US, the big-business class are just a bunch of selfish, stupid pricks who take huge subsidies and then turn around and bite the hand that feeds them. Having the US intelligence community feed intelligence back to US business would make no difference to the autistic Rand-worshipping hand-flappers who run co

In the US, the big-business class are just a bunch of selfish, stupid pricks who take huge subsidies and then turn around and bite the hand that feeds them. Having the US intelligence community feed intelligence back to US business would make no difference to the autistic Rand-worshipping hand-flappers who run corporate America.

The question becomes "industrial espionage for whom?" Do campaign donors for the winning party get preferential treatment? That's called "corruption" and it's a leading reason why the U.S. is steadily rising the the "government corruption" rankings world-wide. Secondly, the only beneficiaries will be multi-national companies (yes,all your favorite and least favorite brands), most of whom choose to hide their income and assets in tax havens. The CEOs are more than happy to have big U.S. government -- jus

Mandiant page with appendix and hashes for their materials here [mandiant.com].

I was reading through this last night and it contains some interesting details, but is also something of an advertisement for Mandiant's services. Some highlights:

The name of the group is People's Liberation Army Unit 61398 in Shanghai, and Mandiant has found that one of their personas uses easy to remember passwords for the many accounts he sets up, including a sort of mnemonic for the unit's number (“2j3c1k” likely stands for 2 ju 3 chu 1 ke, which likely stands for 2nd Bureau, 3rd Division, 1st Section, which is the official name of Unit 61398). The majority of attacks come from the neighborhood where this unit is based, and they have been supplied with "special" fiber connections "in the name of national defense."

The group is focused on the U.S. and Canada, and is mostly interested in attacking the information technology industry, but has taken an interest in aerospace, public administration, satellites and telecom, scientific research, energy and transportation.

They include interesting profiles of three "personas" known to be involved in the units attacks: Malware author "Ugly Gorilla" (a.k.a. "Wang Dong"), hacker "DOTA" (whose gmail account they claim to have broken into, and they provide a screenshot) and tool author "SuperHard" (Mei Qiang).

The group uses the term “rouji,” which translates to "Meat Chicken," in their software to refer to infected computers.

The releasing of that many indicators and this information a)Puts Mandiant as a business and as individual employees at risk of retaliation and b)Means that the Chinese will change their tactics away from the indicators that have been released, so Mandiant and their clients will have *less* visibility than they had before. The report was released for the common good, IMO.

Can you imagine a Central Intelligence Agency Unit 61398 in New York. They purchase an apartment building under the name CIA and setup shop and start hacking foreign countries. This just stinks of stupidity, perhaps I've watched to many movies.

posting anon for obvious reasons. I work for a very large tech company, and we've been trying to remove these bastards for years. YEARS. But the admins still click on cutepicture.exe in their email, and the devs always open the malicious Confidential2012salaries.ppt.... so it's like one big game of whack-a-mole. When we get more effective, sometimes we can maintain a dry environment for a good long time. Other times they throw serious resources at us and we get flooded, sometimes even tracing malicious action to short-term contractors physcially working in the US. It's like a swarm of locusts, picking through every bit of data with commercial value. I think one thing that escapes many US/EU security people is the scale of the PRC effort. When you have tens of thousands of people at your disposal, and update your overall plans every 5 years, it's never "a hack." If you do anything they're interested in, they're in your house.

But two alternate realities persist:1. The Chinese government will continue to vapidly claim that attribution based on years of solid data are "unfounded and irresponsible" accusations. It is difficult to understand or engage with an adversary on any constructive level when their government consistently spouts predictable juvenile lies.2. Our/your PR & legal people will steadfastly refuse to discuss the long-game nature of the Chinese intrusions, and deny they started 2-5-10 years ago and persist to this day. (We got a good chuckle out of the NYT assertion that the intruders entered only a few months ago, and that they have been eradicated from the network. I believe their corp lawyers said that. Any tech who believes either assertion it is a fool.)

Your post seems to be a bunch of complaining on how your company seems completely and utterly powerless to do anything about stupid behavior by its employees. Just have your mail admins deny attachments on email. For example, if it comes from external sources, don't let attachments of any kind get through or only allow certain ones. This is rather trivial to fix. I have to wonder just how smart your "large tech company" is since they seem to have no clue on how to stop this sort of thing.

Like I said weeks ago... dont you think those sshd / mail password crackers from china are all part of the chinese govt? I do... you inevitably play the numbers game... get a box... locally exploit it... get root(or in some cases get root from password cracking). From there you sniff, grab the shadow file and run jtr... Now you have more passwords. People reuse passwords, so try it on anything their user logged in from, etc... eventually you spread like a virus... All the way into the lair of your enemies.

With the advent of modern weaponry, overwhelming numbers of troops being a tactical advantage became a thing of the past. No longer could you simply overwhelm your foe with bodies. One small unit with heavy machine guns or a tank or air support could take out much larger opposing forces who were not as well armed. We now see this situation reversing itself. China has an over abundance of warm bodies and they can easily throw many more people at cyber-warfare and cyber-espionage than we can. Other than gradually moving more infrastructure off the public internet and blocking massive swathes of IP address space, I don't see any solution to this that won't be so cost-prohibitive that we end up bankrupting ourselves (more) to fend them off. Even blocking IPs doesn't work now when they control botnets in our borders. The battle lines are continuously obscured. How can you defend when there is no direction to defend from? Even moving infrastructure to private networks is complicated as there is great cost associated when you need to move data or tasks to and from the public internet. China isn't going away, and they have no incentive to stop trying to hack our systems. We have nowhere near the manpower it would take to respond in kind and doing something like Stuxnet on them would likely backfire or escalate beyond our control. Maybe that escalation is the only solution. It's scary.

Really? By my reckoning the Romans had the equivalent to modern weapons vs. the tribal low-tech Britons. At any rate, yes, I mainly meant "enough guys to win, no matter what" and it doesn't change my point about China's raw manpower being a big problem in this area.

If you're playing catchup in terms of technology and your power is in ability to manufacture on a vast scale, corporate espionage makes perfect sense. It's unfortunate that here we only have technology to steal and not much in terms of production capacity. That's a substantial disadvantage.

While there's no doubt that there are hundreds of thousands of hackers in China (not surprising given the population there), and there is little doubt that many of them are going to be hacking the "Big Bad" (i.e., the U.S.), this is mostly a PR campaign for Mandiant and Richard Beitjich.

Beitjich has been bitching and moaning about China for years now. He won't be satisfied until the US is at war with China - not cyberwar, REAL war.

The problem is multiple:

1) First, there is my "security meme" which should be engraved on everyone's forehead:

"You can haz better security, you can haz worse security. But you cannot haz 'security'. There is no security. Deal."

This means there is no way to keep hackers out of your networks, given the state of the software and telecommunications industries in terms of software development. There is no secure software (short of some specific stuff used by the DoD - and I'm not sure about thee, as the saying goes) and no secure infrastructure. What one guy can make, another guy can break. This is history.

The consensus in infosec today is that the best you can do is try to detect a breach, react to it and contain it so the enemy doesn't get everything it's after. All attempts at "preventing" hacking are utterly futile.

2) Cybercrime is a "growth industry". It's where the narcotics industry was back in the first half of the 20th Century after the anti-drug laws were passed. It will continue to grow until the software and telecommunications industries change their development practices - and based on human resistance to change, this won't happen until cybercrime is ubiquitous and governments and corporations are nailed to a wall of loss.

3) As we used to say in Federal prison, "I hope you don't like it. What are you going to do about it?" i.e., China is a nuclear power. They have 200 or so nuclear warheads. So what is the US going to do to stop Chinese hackers from spying? Bomb them? Threaten them with trade sanctions and start a trade war - with China owning trillions of dollars of US debt and is the US biggest trading partner? The days are gone when the US can just stomp on countries they don't like. Iran is giving the US the finger over the sanctions on it. How much less is China going to be affected?

Finally, I view this whole situation as "leveling the playing field." This is related to 2) above. The U.S. has used its military and economic clout for a hundred years to overwhelm and push countries all over the world around. What is happening now is that the chickens are coming home to roost. The U.S. "intellectual property" (an oxymoron at best) regime is being looted - as it should be.

So nothing is going to change for at least the next decade, maybe two decades.

The U.S. has used its military and economic clout for a hundred years to overwhelm and push countries all over the world around. What is happening now is that the chickens are coming home to roost. The U.S. "intellectual property" (an oxymoron at best) regime is being looted - as it should be.

So nothing is going to change for at least the next decade, maybe two decades.

So as my meme says: Deal.

What does any of that mean?

Does anyone explain why this was modded up? Because it is bashing the US? How is industrial and corporate espionage in any way, shape, or form acceptable? Reduced to its essential message, what I am hearing is "being a thief and d*ck is cool." Whatever.

Does anyone explain why this was modded up? Because it is bashing the US? How is industrial and corporate espionage in any way, shape, or form acceptable? Reduced to its essential message, what I am hearing is "being a thief and d*ck is cool." Whatever.

No, you've got it wrong. The OP is saying that, "being a thief and d*ck to the US is cool." And yes, it was modded up because it is an anti-US rant.

Because it is the truth? I don't like it one bit, but they've been leeching intellectual property for decades now, and we (the US) have hardly lifted a finger. I've yet to see the US Govt. demonstrate any resolve to deal with this problem in any form or fashion, aside from the occasional murmur in a stump speech. When they actually do say something, china will release a solemn response about about trade wars, protectionism, hints at currency dumping, etc.

Did you like the Mission Impossible movies? tv series?Was it COOL how US spies manipulate the politics and economies of foreign countries?Did you know that Panama was created SOLELY because US wanted to build the Panama canal?

What goest aroud comes around - in the real world.Smart Charlie Wilson sent arms to help the Afghans fight those Soviet Commies - Oops. They became the Taliban...

It doesn't make the hacking right - even if everyone is doing it.The question is what can we do about the open n

Did you like the Mission Impossible movies? tv series?Was it COOL how US spies manipulate the politics and economies of foreign countries?Did you know that Panama was created SOLELY because US wanted to build the Panama canal?

What goest aroud comes around - in the real world.Smart Charlie Wilson sent arms to help the Afghans fight those Soviet Commies - Oops. They became the Taliban...

It doesn't make the hacking right - even if everyone is doing it.The question is what can we do about the open nature of our internet and what COST there is to close up the security caverns...

OK... well, firstly, these are private corporations. There is a difference between them and the U.S. Government. So even if this were somehow fair play, the target of China's aggression wouldn't be the right one by your logic. It's sloppy reasoning, and what I am (rightly) responding to is reflexive, unreasoning anti-US rhetoric.

Secondly, if I understand the history, the reason the Taliban because imminent in regional politics is that after we rescinded military and intelligence aid from Afghanistan, we did

These Chinese hackers are not nearly as good as the press makes them out to be. In fact, they are on advanced amateur level at best. Instead, the security of the corporate and governmental networks they are attacking sucks badly, both from a technological side and with regard to the human angle.

So we live in an age when there is no privacy. That sucks. But I don't very much mind living in an age without real governmental secrecy. I think that all the major governments can basically see each other's underpants, and I think that makes everyone feel safer. Also, it very much disincentivises massive villainous plots, because by default, you should expect them to be discovered. I think it's actually making us safer.

I noticed my work PC was starting to run real slow. I tried Google searches, but came up with nothing for the file. After search of exe on hard drive, I see on properties it is Mandiant with Symantec
signature: "C:\Program Files\Products\System Time\systimecmf.exe"
Any idea how to slow down this program to allow my PC to run faster?